Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@lobehub/lobehub

3 known vulnerabilities (1 critical, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 1 critical, 2 medium
Weekly downloads
986
Dependents
0
Registry
npm

Advisories 3

  • CVE-2026-54157Critical 9.0

    LobeHub: Unauthenticated SSRF in `/webapi/proxy`

    Affected: fixed in 2.1.57.

  • CVE-2026-42045Medium 6.2

    LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)

    Affected: through 2.1.26.

  • CVE-2026-39411Medium 5.0

    LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header

    Affected: fixed in 2.1.48.